How to create a new field using value from another field?

Elastic Stack Logstash
1

I have json data that I'm using the Json filter on to turn into fields. I want to use the elapsed filter so I need the value of one of the fields to act as the start and end tag. Is there any filter that allows you to turn the value of a field into its own field so it can be used as a tag? ie.

"field" : "value"
"field1" : "value1"
"status" : "started"

I would like to become

"field" : "value"
"field1" : "value1"
"status" : "started"
started

If there is a way to use the elapsed filter without having to do this I'm all for it.

2

You can use add_field.

example:

mutate {
     add_field => { "my_new_field" => "%{my_field}" }
}

Edit: changed my example as I think you need add_field, not add_tag.

1 Like
3

Thank you for the response. I was looking for a way to name the new field after the value of another field so it can be used with the Elapsed filter. Do you know if this is possible? Or if it's possible to use the Elapsed filter and have the start and end tags be the values in certain fields?

4

In an elapsed filter you need tags. If you want the start and end tags to depend on the value of the field status you can use

mutate { add_tag => [ "%{status}" ] }
1 Like
5

It works perfectly! Thank you so much.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.